topic Re: Push logs from rsyslog into splunk in Getting Data In

Push logs from rsyslog into splunk

bhavya_shah — Tue, 09 Jul 2013 00:40:58 GMT

I was able to setup rsyslog to push logs into splunk but issue is only /var/log/messages are pushed to splunk but i have many more logs such as /logs/server-logs/servername/* on rsyslog server that I want to push it to splunk. Is there a way to push it?

Re: Push logs from rsyslog into splunk

adrianathome — Tue, 09 Jul 2013 00:55:54 GMT

You need to create an inputs.conf file on your forwarder that has a stanza for all the logs that you want.

Re: Push logs from rsyslog into splunk

bhavya_shah — Tue, 09 Jul 2013 00:57:16 GMT

If you dont mind can you share the example inputs.conf file?

Re: Push logs from rsyslog into splunk

msettipane — Tue, 09 Jul 2013 00:59:06 GMT

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Configureyourinputs

Re: Push logs from rsyslog into splunk

adrianathome — Tue, 09 Jul 2013 01:01:33 GMT

http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Exampleaddaninputtoforwarders

Re: Push logs from rsyslog into splunk

grijhwani — Tue, 09 Jul 2013 01:08:55 GMT

In its simplest form you just need something like the following stanza in the inputs.conf on the rsyslog server. (I assume, from the mention of other logs already being pushed, you have installed a light forwarder instance at the very least.)

[monitor:///logs/server-logs/]
host_segment = 3
sourcetype = syslog
index = syslog
disabled = false

As splunk try the following:

bin/splunk btool inputs list --debug

This should show you your complete inputs configuration.

To interrogate what is or is not being consumed, point this at your indexer:

https://{yoursplunkserver}:8089/services/admin/inputstatus/TailingProcessor:FileStatus

It will show you what is and what is not being processed, and why.

Re: Push logs from rsyslog into splunk

bhavya_shah — Tue, 09 Jul 2013 18:22:51 GMT

Even though I added stanza in inputs.conf file I still dont see logs coming into splunk. I am not sure what I am missing here.

Re: Push logs from rsyslog into splunk

bhavya_shah — Tue, 09 Jul 2013 22:53:33 GMT

I tried and it does show me complete inputs.conf info but still dont know why its not pushing the log.

Re: Push logs from rsyslog into splunk

bhavya_shah — Thu, 11 Jul 2013 23:33:36 GMT

I am still not getting logs but I have more issue.

/opt/splunkforwarder/bin/splunk list forward-server

Active forwards:
None
Configured but inactive forwards:
servername:9997

Here is the exact error on my forwarder on splunkd.log

07-11-2013 16:19:56.153 -0700 WARN TcpOutputProc - Cooked connection to ip=ipaddress:9997 timed out

Re: Push logs from rsyslog into splunk

grijhwani — Thu, 11 Jul 2013 23:42:07 GMT

In that case you seem to have firewall or routing issues.

Re: Push logs from rsyslog into splunk

bhavya_shah — Mon, 15 Jul 2013 16:34:57 GMT

Firewall issue has been fixed but in splunkd.log I am seeing following error:

07-15-2013 04:09:36.647 -0700 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
07-15-2013 04:09:38.935 -0700 INFO TailingProcessor - ...continuing.

07-15-2013 04:10:00.879 -0700 INFO BatchReader - Removed from queue file=

07-15-2013 09:27:38.824 -0700 INFO WatchedFile - Will begin reading at offset

Re: Push logs from rsyslog into splunk

bhavya_shah — Tue, 16 Jul 2013 21:58:03 GMT

http://splunk-base.splunk.com/answers/95281/having-issues-with-universal-forwarder

http://splunk-base.splunk.com/answers/95503/how-to-setup-universal-forwarder-on-linux

Re: Push logs from rsyslog into splunk

Joanna — Sun, 26 May 2024 10:05:41 GMT

Hi Bhavya,

What add-ons did you need on Splunk enterprise to receive logs from rsyslog client?

Was rsyslog on an external system?

Thanks.

Joanna.

Re: Push logs from rsyslog into splunk

PickleRick — Sun, 26 May 2024 21:26:20 GMT

In case you haven't noticed, this is a really old thread. Your question might not get the visibility you want in this thread. Try starting a new thread describing your problem in the Getting Data In section of this forum.